31 lines
1.3 KiB
Markdown
31 lines
1.3 KiB
Markdown
# UNDF: UNDF-2026-000000495
|
|
# OSRM — CWE-407 Scan Result: CLEAN
|
|
|
|
## Scan Date
|
|
2026-03-27
|
|
|
|
## Files Scanned
|
|
- `src/engine/routing_algorithms/alternative_path_ch.cpp`
|
|
- `src/engine/routing_algorithms/alternative_path_mld.cpp`
|
|
- `src/engine/routing_algorithms/routing_base_ch.cpp`
|
|
- `src/engine/routing_algorithms/routing_base_mld.cpp`
|
|
- `src/engine/routing_algorithms/shortest_path.cpp`
|
|
- `src/contractor/` (full directory)
|
|
- `src/extractor/` (full directory)
|
|
|
|
## Findings
|
|
|
|
**No CWE-407 defects found in routing hot paths.**
|
|
|
|
OSRM explicitly uses appropriate O(1) data structures:
|
|
|
|
- `alternative_path_ch.cpp` line 638: `std::unordered_set<NodeID> nodes_in_path` — correct O(1) node membership for path sharing calculation
|
|
- `alternative_path_mld.cpp` line 292: `std::unordered_set<CellID> cells` — correct O(1) cell membership for path deduplication
|
|
- `std::find` uses found: all on small bounded vectors (trip waypoints, class names, via lists) — not in O(N) traversal loops
|
|
|
|
## Notes
|
|
|
|
OSRM's CH alternative path solver (`alternative_path_ch.cpp`) demonstrates the correct pattern
|
|
that GraphHopper's `AlternativeRouteCH.java` should follow: the shortest path node set is built
|
|
as `std::unordered_set<NodeID>` before iterating the search space, giving O(1) membership
|
|
tests during the O(E) sweep.
|